CVE-2017-8291 Artifex Ghostscript Type Confusion
Attackers can execute arbitrary commands by bypassing the -dSAFER sandbox via type confusion in crafted EPS files processed by Ghostscript.
- Exploited in the wild
- Since 24 May 2022
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-8291?
CVE-2017-8291 is a high-severity code injection vulnerability in Artifex Ghostscript, published on 27 Apr 2017. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.
Weakness: CWE-843
Which versions are affected by CVE-2017-8291?
It affects 8 products.
Linux distribution packages (40)
ghostscript Red Hat:enterprise_linux:6::client | All versions | 0:8.70-23.el6_9.2 |
ghostscript-debuginfo Red Hat:enterprise_linux:6::client | All versions | 0:8.70-23.el6_9.2 |
ghostscript-devel Red Hat:enterprise_linux:6::client | All versions | 0:8.70-23.el6_9.2 |
ghostscript-doc Red Hat:enterprise_linux:6::client | All versions | 0:8.70-23.el6_9.2 |
ghostscript-gtk Red Hat:enterprise_linux:6::client | All versions | 0:8.70-23.el6_9.2 |
ghostscript Red Hat:enterprise_linux:6::computenode | All versions | 0:8.70-23.el6_9.2 |
ghostscript-debuginfo Red Hat:enterprise_linux:6::computenode | All versions | 0:8.70-23.el6_9.2 |
ghostscript-devel Red Hat:enterprise_linux:6::computenode | All versions | 0:8.70-23.el6_9.2 |
ghostscript-doc Red Hat:enterprise_linux:6::computenode | All versions | 0:8.70-23.el6_9.2 |
ghostscript-gtk Red Hat:enterprise_linux:6::computenode | All versions | 0:8.70-23.el6_9.2 |
ghostscript Red Hat:enterprise_linux:6::server | All versions | 0:8.70-23.el6_9.2 |
ghostscript-debuginfo Red Hat:enterprise_linux:6::server | All versions | 0:8.70-23.el6_9.2 |
ghostscript-devel Red Hat:enterprise_linux:6::server | All versions | 0:8.70-23.el6_9.2 |
ghostscript-doc Red Hat:enterprise_linux:6::server | All versions | 0:8.70-23.el6_9.2 |
ghostscript-gtk Red Hat:enterprise_linux:6::server | All versions | 0:8.70-23.el6_9.2 |
ghostscript Red Hat:enterprise_linux:6::workstation | All versions | 0:8.70-23.el6_9.2 |
ghostscript-debuginfo Red Hat:enterprise_linux:6::workstation | All versions | 0:8.70-23.el6_9.2 |
ghostscript-devel Red Hat:enterprise_linux:6::workstation | All versions | 0:8.70-23.el6_9.2 |
ghostscript-doc Red Hat:enterprise_linux:6::workstation | All versions | 0:8.70-23.el6_9.2 |
ghostscript-gtk Red Hat:enterprise_linux:6::workstation | All versions | 0:8.70-23.el6_9.2 |
ghostscript Red Hat:enterprise_linux:7::client | All versions | 0:9.07-20.el7_3.5 |
ghostscript-cups Red Hat:enterprise_linux:7::client | All versions | 0:9.07-20.el7_3.5 |
ghostscript-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:9.07-20.el7_3.5 |
ghostscript-devel Red Hat:enterprise_linux:7::client | All versions | 0:9.07-20.el7_3.5 |
ghostscript-doc Red Hat:enterprise_linux:7::client | All versions | 0:9.07-20.el7_3.5 |
ghostscript-gtk Red Hat:enterprise_linux:7::client | All versions | 0:9.07-20.el7_3.5 |
ghostscript Red Hat:enterprise_linux:7::computenode | All versions | 0:9.07-20.el7_3.5 |
ghostscript-cups Red Hat:enterprise_linux:7::computenode | All versions | 0:9.07-20.el7_3.5 |
ghostscript-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 0:9.07-20.el7_3.5 |
ghostscript-devel Red Hat:enterprise_linux:7::computenode | All versions | 0:9.07-20.el7_3.5 |
ghostscript-doc Red Hat:enterprise_linux:7::computenode | All versions | 0:9.07-20.el7_3.5 |
ghostscript-gtk Red Hat:enterprise_linux:7::computenode | All versions | 0:9.07-20.el7_3.5 |
ghostscript Red Hat:enterprise_linux:7::server | All versions | 0:9.07-20.el7_3.5 |
ghostscript-cups Red Hat:enterprise_linux:7::server | All versions | 0:9.07-20.el7_3.5 |
ghostscript-debuginfo Red Hat:enterprise_linux:7::server | All versions | 0:9.07-20.el7_3.5 |
ghostscript-devel Red Hat:enterprise_linux:7::server | All versions | 0:9.07-20.el7_3.5 |
ghostscript-doc Red Hat:enterprise_linux:7::server | All versions | 0:9.07-20.el7_3.5 |
ghostscript-gtk Red Hat:enterprise_linux:7::server | All versions | 0:9.07-20.el7_3.5 |
ghostscript Red Hat:enterprise_linux:7::workstation | All versions | 0:9.07-20.el7_3.5 |
ghostscript-cups Red Hat:enterprise_linux:7::workstation | All versions | 0:9.07-20.el7_3.5 |
Products include Artifex Ghostscript, Debian Debian Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Eus, Redhat Enterprise Linux Server, Redhat Enterprise Linux Server Aus and 2 more.
How do I fix CVE-2017-8291?
Apply the vendor's patch. US federal agencies must fix it by 14 Jun 2022.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2017-8291 being exploited?
Yes. Attackers have exploited CVE-2017-8291 in the wild since at least 24 May 2022.
Public exploit code: 1 Metasploit module, 2 Exploit-DB entries and 2 proofs of concept on GitHub.
Other vulnerabilities in Artifex Ghostscript
Sources
Also known as ALPINE-CVE-2017-8291, DEBIAN-CVE-2017-8291, DLA-932-1, GHSA-rh88-cwv2-gjxm, RHSA-2017:1230, SUSE-SU-2017:1153-1 and 2 more.